An attacker can send a forged VMCI packet from an arbitrary context, causing the Linux kernel’s vmci_transport_recv_stream_cb() to reset a socket that it does not own. The original implementation first matches sockets by a full source‑destination tuple and, if that fails, falls back to a destination‑only lookup without verifying that the packet came from the socket’s stored peer. This flaw allows a malicious packet to be matched to a non‑listening socket and trigger a reset, thereby disrupting or terminating connections on the host. The impact is a denial of service and unintended state changes in network communication within the affected system.

The flaw exists in the Linux kernel’s VMCI subsystem. Any kernel that includes VMCI support and handles connected sockets is vulnerable. The exact kernel versions are not specified in the report, so all releases prior to the patch commit (c027f8b4) should be considered at risk.

The vulnerability is rooted in improper input validation. No CVSS or EPSS score is available, and the issue is not listed in the CISA KEV catalog, indicating limited reported exploitation. The likely attack vector is a local attacker with the ability to craft and inject VMCI packets, such as a privileged user or a compromised virtual machine inside the same host. While the exploit requires specific VMCI context control, exploitation could lead to disruption of services through unauthorized socket resets. The overall risk is moderate but should not be ignored in environments relying on VMCI.